Skip to content

Commit f017687

Browse files
keshav-spacekeshav-space
committed
Add tests for Advisory ToDos
Signed-off-by: Keshav Priyadarshi <git@keshav.space>
1 parent 0956910 commit f017687

File tree

1 file changed

+167
-0
lines changed

1 file changed

+167
-0
lines changed

‎vulnerabilities/tests/pipelines/test_compute_advisory_todo.py‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
#
2+
# Copyright (c) nexB Inc. and others. All rights reserved.
3+
# VulnerableCode is a trademark of nexB Inc.
4+
# SPDX-License-Identifier: Apache-2.0
5+
# See http://www.apache.org/licenses/LICENSE-2.0 for the license text.
6+
# See https://github.com/aboutcode-org/vulnerablecode for support or download.
7+
# See https://aboutcode.org for more information about nexB OSS projects.
8+
#
9+
10+
from datetime import datetime
11+
12+
from django.test import TestCase
13+
from packageurl import PackageURL
14+
15+
from vulnerabilities.importer import AdvisoryData
16+
from vulnerabilities.importer import AffectedPackage
17+
from vulnerabilities.importer import Reference
18+
from vulnerabilities.models import Advisory
19+
from vulnerabilities.models import AdvisoryToDo
20+
from vulnerabilities.models import Alias
21+
from vulnerabilities.pipelines.compute_advisory_todo import ComputeToDo
22+
23+
24+
class TestComputeToDo(TestCase):
25+
def setUp(self):
26+
self.advisory_data1 = AdvisoryData(
27+
summary="Test summary",
28+
affected_packages=[
29+
AffectedPackage(
30+
package=PackageURL(type="npm", name="package1"),
31+
affected_version_range="vers:npm/>=1.0.0|<2.0.0",
32+
fixed_version="2.0.0",
33+
)
34+
],
35+
references=[Reference(url="https://example.com/vuln1")],
36+
url="https://test.url/",
37+
)
38+
39+
self.advisory_data2 = AdvisoryData(
40+
summary="Test summary",
41+
affected_packages=[
42+
AffectedPackage(
43+
package=PackageURL(type="npm", name="package1"),
44+
affected_version_range="vers:npm/>=1.0.0|<2.0.0",
45+
)
46+
],
47+
references=[Reference(url="https://example.com/vuln1")],
48+
url="https://test.url/",
49+
)
50+
51+
self.advisory_data3 = AdvisoryData(
52+
summary="Test summary",
53+
affected_packages=[
54+
AffectedPackage(
55+
package=PackageURL(type="npm", name="package1"),
56+
fixed_version="2.0.0",
57+
)
58+
],
59+
references=[Reference(url="https://example.com/vuln1")],
60+
url="https://test.url/",
61+
)
62+
63+
self.advisory_data4 = AdvisoryData(
64+
summary="Test summary",
65+
affected_packages=[
66+
AffectedPackage(
67+
package=PackageURL(type="npm", name="package1"),
68+
affected_version_range="vers:npm/>=1.0.0|<=2.0.0",
69+
fixed_version="2.0.1",
70+
)
71+
],
72+
references=[Reference(url="https://example.com/vuln1")],
73+
url="https://test.url/",
74+
)
75+
76+
def test_advisory_todo_missing_summary(self):
77+
date = datetime.now()
78+
Advisory.objects.create(
79+
unique_content_id="test_id",
80+
url=self.advisory_data1.url,
81+
summary="",
82+
affected_packages=[pkg.to_dict() for pkg in self.advisory_data1.affected_packages],
83+
references=[ref.to_dict() for ref in self.advisory_data1.references],
84+
date_imported=date,
85+
date_collected=date,
86+
created_by="test_pipeline",
87+
)
88+
pipeline = ComputeToDo()
89+
pipeline.execute()
90+
91+
todos = AdvisoryToDo.objects.first()
92+
self.assertEqual(1, AdvisoryToDo.objects.count())
93+
self.assertEqual("MISSING_SUMMARY", todos.issue_type)
94+
95+
def test_advisory_todo_missing_fixed(self):
96+
date = datetime.now()
97+
Advisory.objects.create(
98+
unique_content_id="test_id",
99+
url=self.advisory_data2.url,
100+
summary=self.advisory_data2.summary,
101+
affected_packages=[pkg.to_dict() for pkg in self.advisory_data2.affected_packages],
102+
references=[ref.to_dict() for ref in self.advisory_data2.references],
103+
date_imported=date,
104+
date_collected=date,
105+
created_by="test_pipeline",
106+
)
107+
pipeline = ComputeToDo()
108+
pipeline.execute()
109+
110+
todos = AdvisoryToDo.objects.first()
111+
self.assertEqual(1, AdvisoryToDo.objects.count())
112+
self.assertEqual("MISSING_FIXED_BY_PACKAGE", todos.issue_type)
113+
114+
def test_advisory_todo_missing_affected(self):
115+
date = datetime.now()
116+
Advisory.objects.create(
117+
unique_content_id="test_id",
118+
url=self.advisory_data3.url,
119+
summary=self.advisory_data3.summary,
120+
affected_packages=[pkg.to_dict() for pkg in self.advisory_data3.affected_packages],
121+
references=[ref.to_dict() for ref in self.advisory_data3.references],
122+
date_imported=date,
123+
date_collected=date,
124+
created_by="test_pipeline",
125+
)
126+
pipeline = ComputeToDo()
127+
pipeline.execute()
128+
129+
todos = AdvisoryToDo.objects.first()
130+
self.assertEqual(1, AdvisoryToDo.objects.count())
131+
self.assertEqual("MISSING_AFFECTED_PACKAGE", todos.issue_type)
132+
133+
def test_advisory_todo_conflicting_fixed_affected(self):
134+
alias = Alias.objects.create(alias="CVE-0000-0000")
135+
date = datetime.now()
136+
adv1 = Advisory.objects.create(
137+
unique_content_id="test_id1",
138+
url=self.advisory_data1.url,
139+
summary=self.advisory_data1.summary,
140+
affected_packages=[pkg.to_dict() for pkg in self.advisory_data1.affected_packages],
141+
references=[ref.to_dict() for ref in self.advisory_data1.references],
142+
date_imported=date,
143+
date_collected=date,
144+
created_by="test_pipeline",
145+
)
146+
adv1.aliases.add(alias)
147+
adv2 = Advisory.objects.create(
148+
unique_content_id="test_id2",
149+
url=self.advisory_data4.url,
150+
summary=self.advisory_data4.summary,
151+
affected_packages=[pkg.to_dict() for pkg in self.advisory_data4.affected_packages],
152+
references=[ref.to_dict() for ref in self.advisory_data4.references],
153+
date_imported=date,
154+
date_collected=date,
155+
created_by="test_pipeline",
156+
)
157+
adv2.aliases.add(alias)
158+
159+
pipeline = ComputeToDo()
160+
pipeline.execute()
161+
162+
todos = AdvisoryToDo.objects.first()
163+
self.assertEqual(1, AdvisoryToDo.objects.count())
164+
self.assertEqual("CONFLICTING_AFFECTED_AND_FIXED_BY_PACKAGES", todos.issue_type)
165+
self.assertIn(
166+
"CVE-0000-0000: pkg:npm/package1 with conflicting fixed version", todos.issue_detail
167+
)

0 commit comments

Comments
 (0)